Browse CVEs by Ecosystem and Severity

Parse Server has role escalation and CLP bypass via direct `_Join` table write

Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter

Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload

@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes

Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

Feathers has an OAuth Callback Account Takeover issue

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE

Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

Parse Server: SQL injection via dot-notation field name in PostgreSQL

StudioCMS has Privilege Escalation via Insecure API Token Generation

OneUptime has Synthetic Monitor RCE via exposed Playwright browser object

OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover

OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects

Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

OneUptime: Synthetic Monitor RCE via exposed Playwright browser object

OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration

Flowise has Authorization Bypass via Spoofed x-request-from Header

@perfood/couch-auth has a host header injection vulnerability

Immutable is vulnerable to Prototype Pollution

In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program

OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode

OpenClaw's config env vars allowed startup env injection into service runtime

OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode

OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>

OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway

OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write

CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths

`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization

Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Storybook Dev Server is Vulnerable to WebSocket Hijacking

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

Rollup 4 has Arbitrary File Write via Path Traversal

Basic FTP has Path Traversal Vulnerability in its downloadToDir() method

n8n: Expression Sandbox Escape Leads to RCE

n8n has Arbitrary Command Execution via File Write and Git Operations

n8n has Potential Remote Code Execution via Merge Node

n8n has a Sandbox Escape in its JavaScript Task Runner

n8n has Arbitrary File Read via Python Code Node Sandbox Escape

n8n has Unauthenticated Expression Evaluation via Form Node

Parse Dashboard is Missing Authorization for its Agent Endpoint

Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

Parse Dashboard has incomplete authentication on AI Agent endpoint

OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

@enclave-vm/core is vulnerable to Sandbox Escape

FUXA has JWT Authentication Bypass via HTTP Referer header spoofing

OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE